T09 · Insecure Skill Coding Practices
Warning
- Location
- src/utils/request.js:106
- Finding
- API Token Transmitted in URL Query Strings<![CDATA[ ## Vulnerability Details **File Location**: `src/api/search.js:59-62, 104-107`; `src/api/comment.js:38-41, 67-70`; `src/api/post.js:23-25, 50-52`; `src/api/hot.js:19-21`; `src/utils/request.js:106-118, 128-138` **Vulnerability Type**: Credential exposure through URL query parameters **Risk Level**: Medium ### Vulnerable Code The API modules place the token in the parameter object: ```js // src/api/search.js:59-62 const params = { _: Date.now(), token: token, }; ``` The request utility then serializes every parameter, including the token, into the URL: ```js // src/utils/request.js:106-118 const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, }; ``` GET requests use the same behavior: ```js // src/utils/request.js:128-138 const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Accept-Encoding": "identity" }, }; return await request(options); ``` ### Technical Analysis Although HTTPS encrypts the request in transit, it does not make query strings an appropriate location for bearer credentials. The token becomes part of the HTTP request target, such as: ```text /api/douyin/comment/info?_=...&token=<credential>&url=... ``` Request targets are routinely recorded by origin-server access logs, reverse proxies, API gateways, tracing platforms, monitoring agents, and diagnostic systems. Consequently, the token may be exposed to systems and personnel that should not receive authentication credentials. This behavior affects all implemented API capabilities: search, hot-list retrieval, creator-post retrieval, and comment retrieval. ### Attack Path 1. A user stores a valid creden ...[truncated 1015 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `token` from all URL parameter objects. 2. Transmit the credential in an authorization header, for example: ```js const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, }; ``` 3. Refactor `postJson`, `getJson`, and `requestApi` so the credential is passed separately from ordinary query parameters. 4. Configure the server, reverse proxies, and telemetry systems to redact authorization headers and sensitive request metadata. 5. Rotate tokens that have previously been transmitted in URLs, because they may already exist in historical logs. 6. Add automated tests that fail if `token`, `authorization`, or other credential fields appear in generated request paths. ]]>